CLAIMS 

What is claimed is: 

1. A method of analyzing network traffic on a network, the network traffic 
having been captured at a network monitoring computer during a period of time, the 
method comprising: 

at a user computer remote from the network monitoring computer, 
receiving data points corresponding to the captured network traffic, the data 
points comprising: 

for the captured network traffic, start time, end time, total frames 
and total bytes; and 

information about sections of the captured network traffic, the 
information including start time, end time, number of frames in the section 
and number of bytes in the section; and 

storing a histogram, including the data points, at the user computer. 



2. The method of claim 1, further comprising at the user computer, 
presenting a user with a graphical user interface representation of the network traffic by 
Og ^ : graphing byte density over time in a capture histogram by using the histogram. 
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3. The method of claim 2, wherein presenting a user with a graphical user 
interface representation of the network traffic comprises: 

including a zoom window, the zoom window useful for highlighting a 
segment of the capture histogram; and 

representing the segment of the capture histogram in a zoom histogram. 



4. The method of claim 3, further comprising: 

including a data selection window useful for highlighting a segment of the 
zoom histogram; 

storing a first downloaded captured data file that includes sections 
corresponding to the segment of the zoom histogram highlighted by the data 
selection window; and 

displaying data frames corresponding to the highlighted segment of the 
zoom window. 



5. The method of claim 4, further comprising storing a second downloaded 
captured data file that includes sections corresponding to a segment of the zoom 
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O § * M = histogram previously highlighted by the data selection window. 
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3 2 § ^ u 6. The method of claim 4, further comprising storing the first downloaded 

j S captured data file and the histogram together in a folder. 
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7. The method of claim 2, wherein presenting a user with a graphical user 
interface representation of the network traffic comprises applying a compression 
algorithm to at least a portion of the information in the histogram. 



The method of claim 3, wherein representing the segment of the capture 



histogram in a zoom histogram comprises applying a compression algorithm to at least a 
portion of the information in the histogram. 

9. The method of claim 4, the histogram further comprising a listing and 
description of downloaded captured data files stored on the user computer, the method 
further comprising using the listing and description of downloaded captured data files to 
code portions of the capture histogram and the zoom histogram with a first indicator 
representing sections stored at the user computer. 

10. The method of claim 4, further comprising coding portions of the capture 
histogram and the zoom histogram with a second indicator representing sections that 
were previously at the user computer, but that are not presently at the user computer. 




histogram and the zoom histogram with a third indicator representing sections that are not 



stored at the user computer or at the network monitoring computer. 



11. The method of claim 4, further comprising coding portions of the capture 
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12. The method of claim 4, the histogram further comprising a listing and 
description of downloaded captured data files stored on the user computer, the method 
further comprising: 

using the listing and description of downloaded captured data files to color 
code portions of the capture histogram and the zoom histogram with a first color 
representing sections stored at the user computer; 

color coding portions of the capture histogram and the zoom histogram 
with a second color representing sections that were previously at the user 
computer, but that are not presently at the user computer; and 

color coding portions of the capture histogram and the zoom histogram 
with a third color representing sections that are not stored at the user computer or 
at the network monitoring computer. 

13. The method of claim 4, further comprising: 
downloading sections from the network monitoring computer that are not 

stored in downloaded captured data files at the user computer; and 

combining the downloaded sections with a downloaded captured data file 
that was previously stored at the user computer. 

14. The method of claim 1, further comprising saving the histogram for later 




use. 
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15. The method of claim 14, further comprising: 
opening the histogram; 

determining if the histogram corresponds to network traffic stored on the 
network monitoring computer using timestamps; 

if the histogram corresponds to network traffic stored on the network 
monitoring computer, establishing a relationship between the network monitoring 
computer and the user computer such that network traffic existing on the network 
monitoring computer may be downloaded to the user computer. 

16. The method of claim 4, comprising saving a downloaded captured data file 
stored on the user computer for later use. 

1 7. The method of claim 1 6, comprising: 

creating an individual histogram for the downloaded captured data file 
stored on the user computer for later use; and 



displaying the individual histogram at the user computer. 




of claim 1. 



18. A computer readable medium with instructions for performing the method 
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19. A method of managing captured data from a network, the method 
comprising: 

receiving a portion of the captured data from a remote network monitoring 
computer; 

storing at least one downloaded captured data file comprising the portion 
of the captured data, the captured data organized into sections; 
storing a histogram, the histogram comprising: 
a first part containing: 

for all of the captured data, information including start 
time, end time, total frames and total bytes; 

for each of the sections, start times, end times, number of 
frames and bytes/sec; and 

a second part that includes a listing and description of the sections 
that are available in downloaded captured data files. 



20. The method of claim 19, further comprising displaying a graphical user 
interface representation of the network traffic using information in the histogram. 
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22. The method of claim 20, further comprising: 

displaying a data selection window that allows a user to select a portion of 
the graphical user interface representation representing a portion of the captured 
data that the user desires to view; 

in response to a user selecting a portion of the graphical user interface 
representation, downloading sections of the captured data that are not stored in 
downloaded captured data files; and 

storing the downloaded sections of the captured data in a downloaded 
captured data file. 
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23. A computer readable medium having a plurality of data fields representing 
a data structure, the computer readable medium comprising: 

a first data field containing data representing a histogram used to display a 
graphical user interface representing byte density of captured data over time, the 
histogram comprising, for substantially all of the captured data, start time, end 
time, total frames, and total bytes and for sections of the captured data, start times, 
end times, number of frames and bytes per second; 

a second data field containing at least section of captured data stored as at 
least one downloaded captured data file representing sections of captured data; 
and 

a third data field containing data representing a top-level folder for 
organizing the first data filed and the second data field into a file structure. 

24. The computer readable medium of claim 23, the top level folder having 
the same name as the histogram. 

25. The computer readable medium of claim 23, the top-level folder being in 




the same location as the histogram. 



for the section captured data stored at the downloaded captured data file. 



downloaded captured data files having a name that includes the captured data start time 



26. The computer readable medium of claim 23, at least one of the 
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27. The computer readable medium of claim 23, at least one of the 
downloaded captured data files having a name that includes the name of the histogram. 

28. The computer readable medium of claim 23, the histogram being created 
from a downloaded captured data file in response to a downloaded captured data file 
being opened directly. 

29. The computer readable medium of claim 23 at least one of the downloaded 
captured data files being formed from a plurality of downloaded captured data files. 
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